SOX Source Code

One of the internal controls that SOX is interested in auditing is the source code access process. This falls under one or two of the IT internal controls.

To pass the required tests, the company must provide a source code access process that requires the owner of the code to approve access before granting it.

It also requires that only approved developers have write access to the source code and that those same developers do not have access to the application in production.

In addition, it requires a review, usually semi-annual, of the access to the code and an audit trail of this review.

If you can provide this evidence, you can pass this internal control test.

• Prove there is a process for granting source control access
• Provide regular access review to source code
• Show how the process works
• Provide user access lists

[groups]
dev = mit\mjb, mit\bjl, umn\tjd
scm = mit\dearking, umn\stixrud

[/]
@dev = rw

[/admin/svn_access]
@scm = rw